Skip to content

Commit bba8a67

Browse files
dpgeorgedpgeorge
committed
tests: Update SSL network tests to use SSLContext, and work on CPython.
Changes are: - use ssl.SSLContext.wrap_socket instead of ssl.wrap_socket - disable check_hostname and call load_default_certs() where appropriate, to get CPython to run the tests correctly - pass socket.AF_INET to getaddrinfo and socket.socket(), to force IPv4 - change tests to use github.com instead of google.com, because certificate validation was failing with google.com Signed-off-by: Damien George <damien@micropython.org>
1 parent ef996d1 commit bba8a67

6 files changed

Lines changed: 61 additions & 44 deletions

File tree

‎tests/net_hosted/connect_nonblock_xfer.py‎

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -27,11 +27,12 @@ def do_connect(peer_addr, tls, handshake):
2727
print(" got", er.errno)
2828
# wrap with ssl/tls if desired
2929
if tls:
30+
ssl_context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
31+
if hasattr(ssl_context, "check_hostname"):
32+
ssl_context.check_hostname = False
33+
3034
try:
31-
if sys.implementation.name == "micropython":
32-
s = ssl.wrap_socket(s, do_handshake=handshake)
33-
else:
34-
s = ssl.wrap_socket(s, do_handshake_on_connect=handshake)
35+
s = ssl_context.wrap_socket(s, do_handshake_on_connect=handshake)
3536
print("wrap: True")
3637
except Exception as e:
3738
dp(e)

‎tests/net_inet/ssl_errors.py‎

Lines changed: 16 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,12 +1,12 @@
11
# test that socket.connect() on a non-blocking socket raises EINPROGRESS
22
# and that an immediate write/send/read/recv does the right thing
33

4-
import sys, errno, socket, ssl
4+
import sys, errno, select, socket, ssl
55

66

77
def test(addr, hostname, block=True):
8-
print("---", hostname or addr)
9-
s = socket.socket()
8+
print("---", hostname)
9+
s = socket.socket(socket.AF_INET)
1010
s.setblocking(block)
1111
try:
1212
s.connect(addr)
@@ -16,11 +16,15 @@ def test(addr, hostname, block=True):
1616
raise
1717
print("EINPROGRESS")
1818

19+
if sys.implementation.name != "micropython":
20+
# in CPython we have to wait, otherwise wrap_socket is not happy
21+
select.select([], [s], [])
22+
23+
ssl_context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
24+
ssl_context.verify_mode = ssl.CERT_REQUIRED
25+
1926
try:
20-
if sys.implementation.name == "micropython":
21-
s = ssl.wrap_socket(s, do_handshake=block)
22-
else:
23-
s = ssl.wrap_socket(s, do_handshake_on_connect=block)
27+
s = ssl_context.wrap_socket(s, do_handshake_on_connect=block, server_hostname=hostname)
2428
print("wrap: True")
2529
except OSError:
2630
print("wrap: error")
@@ -36,11 +40,11 @@ def test(addr, hostname, block=True):
3640

3741
if __name__ == "__main__":
3842
# connect to plain HTTP port, oops!
39-
addr = socket.getaddrinfo("micropython.org", 80)[0][-1]
40-
test(addr, None)
43+
addr = socket.getaddrinfo("micropython.org", 80, socket.AF_INET)[0][-1]
44+
test(addr, "micropython.org")
4145
# connect to plain HTTP port, oops!
42-
addr = socket.getaddrinfo("micropython.org", 80)[0][-1]
43-
test(addr, None, False)
46+
addr = socket.getaddrinfo("micropython.org", 80, socket.AF_INET)[0][-1]
47+
test(addr, "micropython.org", False)
4448
# connect to server with self-signed cert, oops!
45-
addr = socket.getaddrinfo("test.mosquitto.org", 8883)[0][-1]
49+
addr = socket.getaddrinfo("test.mosquitto.org", 8883, socket.AF_INET)[0][-1]
4650
test(addr, "test.mosquitto.org")

‎tests/net_inet/test_tls_nonblock.py‎

Lines changed: 15 additions & 11 deletions
Original file line numberDiff line numberDiff line change
@@ -2,12 +2,12 @@
22

33

44
def test_one(site, opts):
5-
ai = socket.getaddrinfo(site, 443)
5+
ai = socket.getaddrinfo(site, 443, socket.AF_INET)
66
addr = ai[0][-1]
7-
print(addr)
7+
print(site)
88

99
# Connect the raw socket
10-
s = socket.socket()
10+
s = socket.socket(socket.AF_INET)
1111
s.setblocking(False)
1212
try:
1313
s.connect(addr)
@@ -16,17 +16,22 @@ def test_one(site, opts):
1616
if e.errno != errno.EINPROGRESS:
1717
raise
1818

19+
# Create SSLContext.
20+
ssl_context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
21+
22+
# CPython compatibility:
23+
# - disable check_hostname
24+
# - load default system certificate chain
25+
# - must wait for socket to be writable before calling wrap_socket
1926
if sys.implementation.name != "micropython":
20-
# in CPython we have to wait, otherwise wrap_socket is not happy
27+
ssl_context.check_hostname = False
28+
ssl_context.load_default_certs()
2129
select.select([], [s], [])
2230

2331
try:
2432
# Wrap with SSL
2533
try:
26-
if sys.implementation.name == "micropython":
27-
s = ssl.wrap_socket(s, do_handshake=False)
28-
else:
29-
s = ssl.wrap_socket(s, do_handshake_on_connect=False)
34+
s = ssl_context.wrap_socket(s, do_handshake_on_connect=False)
3035
except OSError as e:
3136
if e.errno != errno.EINPROGRESS:
3237
raise
@@ -87,8 +92,7 @@ def test_one(site, opts):
8792

8893

8994
SITES = [
90-
"google.com",
91-
{"host": "www.google.com"},
95+
"www.github.com",
9296
"micropython.org",
9397
"pypi.org",
9498
{"host": "api.pushbullet.com", "sni": True},
@@ -105,7 +109,7 @@ def main():
105109
test_one(site, opts)
106110
print(site, "ok")
107111
except Exception as e:
108-
print(site, "error")
112+
print(site, "error", e)
109113
print("DONE")
110114

111115

‎tests/net_inet/test_tls_sites.py‎

Lines changed: 19 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,24 +1,34 @@
1+
import sys
2+
import select
13
import socket
24
import ssl
35

4-
# CPython only supports server_hostname with SSLContext
5-
if hasattr(ssl, "SSLContext"):
6-
ssl = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
7-
86

97
def test_one(site, opts):
10-
ai = socket.getaddrinfo(site, 443)
8+
ai = socket.getaddrinfo(site, 443, socket.AF_INET)
119
addr = ai[0][-1]
1210

13-
s = socket.socket()
11+
s = socket.socket(socket.AF_INET)
12+
13+
# Create SSLContext.
14+
ssl_context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
15+
16+
# CPython compatibility:
17+
# - disable check_hostname
18+
# - load default system certificate chain
19+
# - must wait for socket to be writable before calling wrap_socket
20+
if sys.implementation.name != "micropython":
21+
ssl_context.check_hostname = False
22+
ssl_context.load_default_certs()
23+
select.select([], [s], [])
1424

1525
try:
1626
s.connect(addr)
1727

1828
if "sni" in opts:
19-
s = ssl.wrap_socket(s, server_hostname=opts["host"])
29+
s = ssl_context.wrap_socket(s, server_hostname=opts["host"])
2030
else:
21-
s = ssl.wrap_socket(s)
31+
s = ssl_context.wrap_socket(s)
2232

2333
s.write(b"GET / HTTP/1.0\r\nHost: %s\r\n\r\n" % bytes(site, "latin"))
2434
resp = s.read(4096)
@@ -31,8 +41,7 @@ def test_one(site, opts):
3141

3242

3343
SITES = [
34-
"google.com",
35-
"www.google.com",
44+
"www.github.com",
3645
"micropython.org",
3746
"pypi.org",
3847
{"host": "api.pushbullet.com", "sni": True},

‎tests/net_inet/test_tls_sites.py.exp‎

Lines changed: 0 additions & 5 deletions
This file was deleted.

‎tests/net_inet/tls_text_errors.py‎

Lines changed: 6 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,17 @@
11
# test that modtls produces a text error message
22

3-
import socket, ssl, sys
3+
import socket, ssl
44

55

66
def test(addr):
77
s = socket.socket()
88
s.connect(addr)
99
try:
10-
s = ssl.wrap_socket(s)
10+
ssl_context = ssl.SSLContext(ssl.PROTOCOL_TLS_CLIENT)
11+
if hasattr(ssl_context, "check_hostname"):
12+
# Disable hostname check on CPython.
13+
ssl_context.check_hostname = False
14+
s = ssl_context.wrap_socket(s)
1115
print("wrap: no exception")
1216
except OSError as e:
1317
# mbedtls produces "mbedtls -0x7200: SSL - An invalid SSL record was received"

0 commit comments

Comments
 (0)